National Australia Bank's Security Assurance Team have identified a vulnerability in the Visual Sitecore Service, part of the Sitecore CMS application, that allows low privileged users to gain access to administrative and other credentials. Sitecore.NET version 5.3.1 revision 071114 is confirmed vulnerable.
be663a806e2f6981218d4fd1c47ada41a5eea4610934482631bcefc219897d0e
Title:
Sitecore web service information disclosure
CVE Identifier:
____________
Credit:
National Australia Bank's Security Assurance Team.
The vendor was advised of this vulnerability prior to its public release. National Australia Bank adheres to the Guidelines for Security Vulnerability Reporting and Response V2.0 document when issuing security advisories.
Class:
Information Disclosure
Privilege Escalation
Remote:
Yes
Local:
Yes
Vulnerable:
Sitecore.NET 5.3.1 (rev. 071114) other versions may also be vulnerable.
Not Vulnerable:
Vendor:
Sitecore
Discussion:
National Australia Bank's Security Assurance Team have identified a vulnerability in the Visual Sitecore Service, part of the Sitecore CMS application, that allows low privileged users to gain access to administrative and other users credentials.
Exploit:
No exploit code provided. Simple SOAP/XML queries are all that is required.
Solution:
Apply patch V5.3.2 rev. 090212
References:
Vendor Advisory http://sdn5.sitecore.net/Products/Sitecore%20V5/Sitecore%20CMS%205,-d-,3/ReleaseNotes/V5,-d-,3,-d-,2/ChangeLog.aspx